227 lines
11 KiB
JSON
227 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-98544",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.356Z",
|
|
"datePublished": "2026-10-18T15:18:12.964Z",
|
|
"dateUpdated": "2026-10-30T12:38:23.865Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:38:23.865Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbna: prevent IOC timer rearm during teardown\n\nbna: prevent IOC timer rearm during teardown\n\nbnad_pci_remove() and the probe disable_ioceth path call\ntimer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for\niocpf_timer. bnad_iocpf_timeout() then takes bnad->bna_lock after\nfree_netdev() has freed the struct bnad.\n\nDeleting iocpf_timer last does not fix this. sem_timer and\niocpf_timer rearm each other: bnad_iocpf_sem_timeout() can arm\niocpf_timer, and bnad_iocpf_timeout() arms sem_timer from\nbfa_ioc_hw_sem_get() when the semaphore is busy.\ntimer_delete_sync() only waits out its own callback.\nbnad_ioceth_disable() can time out and leave that callback live.\n\nShut all four IOC timers down with timer_shutdown_sync() on both\npaths, so a later mod_timer() is ignored.\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/brocade/bna/bnad.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
|
|
"lessThan": "8160cd1ec527caedd36c36f948234e834cd086e6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
|
|
"lessThan": "3614582375fc4407e09ff42ff178a045e2fe6e8f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
|
|
"lessThan": "f04cbdfac9b8284146995ab7ba0d054ad1d20ec6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
|
|
"lessThan": "28e32ace754b57534ef0ca0fb99bcbea5b13ba2a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
|
|
"lessThan": "4d97a141e85a034566c33c7ed854c8a3e8a268f1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
|
|
"lessThan": "e09d1c6729ee4a7812128902d9274ff565f958b8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "1d32f7696286eef9e5644eb57e79a36756274357",
|
|
"lessThan": "77b1718e39e5c9f6956fb60807326af20baf889d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/brocade/bna/bnad.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.38",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.38",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.224",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.112",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.55",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.9",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.38",
|
|
"versionEndExcluding": "5.15.224"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.38",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.38",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.38",
|
|
"versionEndExcluding": "6.12.112"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.38",
|
|
"versionEndExcluding": "6.18.55"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.38",
|
|
"versionEndExcluding": "7.2.9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.38",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8160cd1ec527caedd36c36f948234e834cd086e6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3614582375fc4407e09ff42ff178a045e2fe6e8f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f04cbdfac9b8284146995ab7ba0d054ad1d20ec6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/28e32ace754b57534ef0ca0fb99bcbea5b13ba2a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4d97a141e85a034566c33c7ed854c8a3e8a268f1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e09d1c6729ee4a7812128902d9274ff565f958b8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/77b1718e39e5c9f6956fb60807326af20baf889d"
|
|
}
|
|
],
|
|
"title": "bna: prevent IOC timer rearm during teardown",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |